- [Instructor] Let's go over
what is insecure direct object references
and what is directory traversal
or path traversal vulnerabilities.
So let's start with insecure direct object references
and this is when an application provides direct access
to objects based on user-supplied input.
So you can take advantage of this vulnerability
to bypass authorization
and also access resources on the systems directly
like for example, you may be able
to access a database record
or files on the system
and again, you can actually bypass authorization
and access resources directly
by modifying the value of a parameter
that is actually used to directly point to an object.
So let's take a look at an example
of insecure direct object reference in here.
Basically, I have the WebGoat vulnerable web application
on the left and I have the OWASP ZAP
or the Zed Attack Proxy on the right.
So I'm navigating to Insecure Direct Object Reference
and by the way, actually they provide a really good,
probably even better explanation
of what it is in the first page
but I'm gonna navigate to the second page here.
I'm actually logged in already
with the user called Tom
and the password is actually cat
but just for demonstration purposes,
I'm gonna log in again.
And then once I'm logged in,
I navigate to the next page
and in there, I will click on the View Profile.
Before I do that,
I'm gonna start the proxy in the OWASP ZAP attack proxy
so the proxy function.
So I'm actually clicking on that.
Going back to WebGoat, I click on View Profile
and as you can actually see,
I'm actually forwarding all the traffic
or the packets actually to the web server
and once I do that, I actually navigate back to WebGoat
in the OWASP ZAP proxy
and under GET profile,
if I go under the response,
you actually see a user ID there
that is not supposed to be displayed
to a normal user.
So you have a userId: 2342384 down on the right.
So I'm actually gonna take a note of that
because if I actually go back
to the WebGoat vulnerable application
and then I continue the exercise,
I can go and then try to predict an alternate path
to the URL and probably get the contents
or that user ID profile
even if I'm not supposed to be able to do so.
So under the form that I have in here,
I go to WebGoat/IDOR
which is actually the path that you saw earlier
in the proxy.
And then /profile
and then after that, I'm gonna put the user ID
that we saw in the proxy.
So once I do that, I click Submit and there you go.
Congratulations, you actually have used an alternate URLs
to view, in this case, our own profile
but this type of example
or these type of attacks
can take place to obtain access
to files on the systems,
to obtain access to database records and many others.
Now that I have gone insecure direct object references,
let's go over what is directory traversal vulnerabilities.
So what are path traversal and basically,
some folks actually call it directory traversal,
other ones call it path
but it's basically the same thing
and this is when a vulnerability actually takes place
in a web application that can allow you
to actually access files and directories
that are stored outside of the web root folder.
So you can actually exploit
these path traversal vulnerabilities
by manipulating variables
that reference files with another name
for the same attack which is called a dot-dot-slash attack.
So if you put a dot, a dot, slash
and then you repeat that
and you go back and try to actually escape back
out of the web root folder,
you may be able to show the contents
of all the files so let's actually do that in here.
And in this example,
I'm actually using the Damn Vulnerable Web Application
and I go under File Inclusion.
After actually I click on that,
you see on the top that I have the page=include.php file
in there and in there,
instead of actually putting the PHP file,
I'm going to put the ../ several times.
Try to escape out of the web root folder
and list the contents of etc/passwd.
So let's actually do that
and send it to the server
and see what actually happens and there you go.
You actually can see that all the entries
in the etc/passwd file.
So this actually can be a very catastrophic vulnerability
because it can allow you either an authenticated
or unauthenticated attacker
to be able to retrieve very sensitive information
from the system.
Now, you can also encode these type
of messages to probably bypass web application firewalls
and some other ones
that I'm actually showing here different combinations
of the encoding methodologies
that you can actually do
for demonstrating the dot-dot-slash.
You can also use
other operating system-specific path structures depending
on slash in Linux or back slash in Windows depending
on the environment
and then, of course, list any files
that you may get access to in the system.
Now, there's a whole bunch of best practices
to actually prevent
and mitigate directory traversal vulnerabilities.
The first one is actually to understand
how the underlying operating system
actually processes file names provided by the user
or an application.
The second one is actually
to never store sensitive configuration files
inside of a web root directory.
That's a given.
And also, to prevent user input
when using the file system calls.
So all those are best practices
to mitigate the path traversal vulnerabilities.